The EU AI Act (Regulation (EU) 2024/1689) is the first broad AI law. It entered into force on 1 August 2024 and applies in stages. It sorts AI systems by risk and places duties on both providers (who build or sell AI) and deployers (organisations that use AI at work). Most businesses that buy AI tools are deployers. This checklist focuses on them.
Key dates
| Date | What applies |
|---|---|
| 2 February 2025 | Bans on prohibited AI practices; AI literacy duty for providers and deployers (Art. 4). |
| 2 August 2025 | Rules for general-purpose AI models; governance and penalties. |
| 2 August 2026 | Most remaining rules, including many high-risk system duties and transparency duties (Art. 50). |
| 2 August 2027 | High-risk AI that is part of products covered by EU safety laws (Art. 6(1)). |
In late 2025 the European Commission proposed delaying some high-risk deadlines as part of a wider “digital omnibus” package. Check the current official timeline before planning around these dates.
Step 1: know which category each AI use falls into
- ☐ Prohibited: social scoring, manipulative techniques that cause harm, untargeted scraping of facial images, emotion recognition at work or school (with narrow exceptions) and others in Article 5. Stop these.
- ☐ High-risk (Annex III): AI used for hiring and managing workers, credit scoring, access to education, essential services, law enforcement and more.
- ☐ Transparency risk: chatbots, AI-generated or edited images, audio, video and text published to inform the public.
- ☐ Minimal risk: most productivity uses such as drafting, summarising and coding help. No specific duties beyond AI literacy, but good practice still applies.
Step 2: duties for every deployer
- ☐ AI literacy (Art. 4): staff who use AI have enough training for their role. Keep a training record.
- ☐ Transparency (Art. 50): tell people when they are talking to an AI system, and label deepfakes and AI-generated text published to inform the public (unless it has been reviewed and someone takes editorial responsibility).
- ☐ An AI acceptable use policy and an inventory of AI tools.
Step 3: extra duties if you deploy high-risk AI (Art. 26)
- ☐ Use the system according to the provider's instructions.
- ☐ Assign human oversight to trained people with authority to intervene.
- ☐ Make sure input data you control is relevant and representative.
- ☐ Monitor operation and tell the provider and authorities about serious incidents.
- ☐ Keep automatically generated logs for at least six months where you control them.
- ☐ Inform workers and their representatives before using high-risk AI at work.
- ☐ Inform people when high-risk AI is used to make or help make decisions about them.
- ☐ Carry out a fundamental rights impact assessment where Article 27 requires it (for example public bodies and certain credit and insurance uses).
Step 4: check your vendors
- ☐ Ask providers of high-risk systems for their conformity documentation and instructions for use.
- ☐ Ask general-purpose AI vendors how they meet their transparency and copyright duties.
- ☐ Record answers in your vendor questionnaire and risk register.
Penalties
Fines can reach €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches, with lower caps for smaller companies.
Frequently asked questions
Does the EU AI Act apply to companies outside the EU?
Yes, if you place AI systems on the EU market or the output of your AI system is used in the EU. A non-EU firm serving EU clients should check its exposure.
Is using ChatGPT or Claude at work high-risk?
Not usually. General drafting and research are minimal risk for the deployer. It becomes high-risk when you use AI for listed purposes such as screening job applicants or scoring credit.